The Child and Family Agency Tusla has classified as "a very high risk" that it may fail to protect the confidentiality of information on its internal computer systems.
The agency collects personal data of the highest sensitivity including people's family circumstances, medical history, criminal convictions, sexual history, and religious beliefs.
A document released under the Freedom of Information Act to RTÉ's This Week programme, outlines a "very high risk" that "Tusla may fail to protect the confidentiality, integrity, and availability of information due to the absence of sufficient risk controls caused by Tusla not having control of its ICT infrastructure and ICT assets".
Tusla said this risk emanates from its formation in 2014, when the vast majority of its staff were transferred from the HSE.
It said: "During the initial years Tusla relied almost entirely on the HSE for ICT infrastructure and support services.
"Tusla has now built its own ICT infrastructure and developed a strong internal ICT capability of 59 staff.
"We are now in the process of migrating all our staff, data, devices and systems off the HSE."
An agency spokesperson said this process would be complete before the end of the year.
The agency also highlighted a "very high" risk that GDPR may be breached "due to inadequate technical and organisational measures".
In 2020, Tusla was fined on two occasions for breaching data protection rules.
When asked about the agency's determination that there is a "very high risk" of further breaches, Tusla said it now has 68 dedicated "whole-time equivalents and specialist staff all focused on improving compliance with GDPR and our responsiveness to the public on issues such as FOIs and Subject Access Requests".
'High' risk to safety of children
On service provision, Tusla has identified a "high" risk to the "safety, well-being and welfare of children due to insufficient capacity/resources to meet existing levels of service demand for Child Protection and Welfare services".
Tusla said this "high" risk is the result of the "difficulty in recruiting and retaining Social Work and Social Care Staff across community and residential services".
It said it has "insufficient residential capacity to meet demand, particularly for children and young people with more complex needs".
The agency stated the challenge of "access to mental health and specialist services for children and young people in care with more complex needs".
To address the staff shortages, the agency said it is engaged in a "targeted recruitment campaign, including the offer of a permanent job to all graduates".
It has also initiated targeted retention measures and is prioritising children at immediate risk of harm.
Foster care
In its internal risk evaluation, Tusla also identified what it classified as a 'high' risk to the safety, welfare, and well-being of children in foster care due to inadequate capacity/resources/systems to ensure compliance with national standards for safeguarding.
When asked about this, Tusla stated there are two significant challenges impacting on compliance levels in relation to Foster Care Standards: "The challenge of recruiting and sustaining a sufficient number of foster placements, particularly for children and young people with more complex or diverse needs."
It also highlighted "the challenge of recruiting and retaining sufficient numbers of Social Workers to ensure statutory responsibilities are fulfilled in line with the standards and associated timelines".
The agency said: "The health, welfare, protection and safety of the children and young people in the care of Tusla is an enduring priority for the agency, and every effort is being made to ensure that the level of care provided is appropriate to the needs of children and young people in the agency's care."
